一、CIFS
1.CIFS系统：Internet文件共享系统，也称服务器信；适用于MicrosoftWindows服务器和客户端的标准文件和打印机的共享系统息块（SMB）
2.Samba服务：用于将linux文件系统作为CIFS/SMB网络文件进行共享，并将linux打印机作为CIFS/SMB打印机进行共享
二、Smb服务
1.安装smb服务
[root@localhost ~]# yum install samba samba-common samba-client -y
2.打开smb，列出共享文件系统信息
[root@localhost ~]# systemctl start smb
[root@localhost ~]# smbclient -L //172.25.254.148
3.设置默认域名 [root@localhost ~]# vim /etc/samba/smb.conf
4.设置黑白名单 [root@localhost ~]# vim /etc/samba/smb.conf
5.设置用户登陆 ##注意：必须是本地用户
6.使用用户登陆
[
三、Smb的Selinx保护
当Selinux=Disable时
1.进入用户家目录编辑
3.设置开机自动挂载
[root@localhost ~]# vim /etc/fstab
[root@localhost ~]# smbclient //172.25.254.108/tom -U tom
Enter tom's password:
Domain=[WESTOS] OS=[Unix] Server=[Samba 4.1.1]
smb: \> ls
NT_STATUS_ACCESS_DENIED listing \*
2.修改sebool值，进入用户家目录编辑
[root@localhost ~]# setsebool -P samba_enable_home_dirs on
[root@localhost ~]# smbclient //172.25.254.108/tom -U tom
Enter tom's password:
Domain=[WESTOS] OS=[Unix] Server=[Samba 4.1.1]
smb: \> ls
. D 0 Thu May 3 21:49:51 2018
.. D 0 Thu May 3 21:46:34 2018
.bash_profile H 193 Wed Jan 29 07:45:18 2014
.mozilla DH 0 Thu Jul 10 18:29:32 2014
.config DH 0 Thu Jul 10 19:06:52 2014
.bashrc H 231 Wed Jan 29 07:45:18 2014
.bash_logout H 18 Wed Jan 29 07:45:18 2014
60458 blocks of size 8192. 56476 blocks available
3.共享目录
用户建立目录:
修改配置文件，共享tets目录
[root@localhost ~]# mkdir /test
[root@localhost ~]# vim /etc/samba/smb.conf
重启smb，可以看到test目录共享信息
[root@localhost ~]# systemctl restart smb.service
[root@localhost ~]# smbclient -L //172.25.254.108/
Enter root's password:
Anonymous login successful
Domain=[WESTOS] OS=[Unix] Server=[Samba 4.1.1]
Sharename Type Comment
--------- ---- -------
test Disk test directory
IPC$ IPC IPC Service (Samba Server Version 4.1.1)
但是，tom用户登陆无法编辑
[root@localhost ~]# smbclient //172.25.254.108/test -U tom
Enter tom's password:
Domain=[WESTOS] OS=[Unix] Server=[Samba 4.1.1]
smb: \> ls
NT_STATUS_ACCESS_DENIED listing \*
修改test目录的安全上下文，重启后再次登陆编辑
[root@localhost ~]# semanage fcontext -a -t samba_share_t '/test(/.*)?'
[root@localhost ~]# restorecon -RvvF /test/
restorecon reset /test context unconfined_u:object_r:default_t:s0->system_u:object_r:samba_share_t:s0
[root@localhost ~]# systemctl restart smb.service
[root@localhost ~]# smbclient //172.25.254.108/test -U tom
Enter tom's password:
Domain=[WESTOS] OS=[Unix] Server=[Samba 4.1.1]
smb: \> ls
. D 0 Thu May 3 22:48:51 2018
.. D 0 Thu May 3 22:48:51 2018
系统目录：
修改配置文件，共享mnt系统目录
[root@localhost ~]# vim /etc/samba/smb.conf
[mnt]
comment = mnt test directory
path =/mnt
重启后查看共享目录信息
[root@localhost ~]# systemctl restart smb.service
[root@localhost ~]# smbclient -L //172.25.254.108/
Enter root's password:
Anonymous login successful
Domain=[WESTOS] OS=[Unix] Server=[Samba 4.1.1]
Sharename Type Comment
--------- ---- -------
test Disk test directory
mnt Disk mnt test directory
IPC$ IPC IPC Service (Samba Server Version 4.1.1）
设定samba的sebool值，打开所有共享目录的读写权限
[root@localhost ~]# setsebool samba_export_all_rw 1
[root@localhost ~]# smbclient //172.25.254.108/mnt -U tom
Enter tom's password:
Domain=[WESTOS] OS=[Unix] Server=[Samba 4.1.1]
smb: \> ls
. D 0 Thu May 11 20:23:52 2017
.. D 0 Thu May 3 22:48:51 2018
四、多用户挂载
1.指定用户具备读写权限
[root@localhost ~]# vim /etc/samba/smb.conf
[test]
comment = test directory
path =/test
write list =tom ##只有tom用户具备权限
##writable = yes ##所有用户具备权限
##write list =@tom ##只有tom组的用户具备权限
2.设定共享目录的读写权限，重启后测试
[root@localhost ~]# chmod 777 /test/
[root@localhost ~]# systemctl restart smb.service
只有tom用户具备权限
[root@localhost ~]# mount //172.25.254.108/test /mnt -o username=tom,password=123
[root@localhost ~]# touch /mnt/file1
[root@localhost ~]# rm -rf /mnt/file1
挂载jerry用户，不具备权限
[root@localhost ~]# umount /mnt
[root@localhost ~]# mount //172.25.254.108/test /mnt -o username=jerry,password=123
[root@localhost ~]# touch /mnt/file2
touch: cannot touch ‘/mnt/file2’: Permission denied
3.用户相关权限设置
security = user
passdb backend = tdbsam
map to guest = bad user ##匿名用户映射为guest
[test]
comment = test directory
path =/test
writeanle = yes
browseable = no ##不显示test共享目录
guest ok = yes ##允许匿名用户登陆
admin users =student ##studet用户编辑时以root用户身份
匿名用户登陆
[root@localhost ~]# mount //172.25.254.108/test /mnt -o username=guest
[root@localhost ~]# df
//172.25.254.108/test 10473900 3186684 7287216 31% /mnt
//172.25.254.108/test on /mnt type cifs (rw,relatime,vers=1.0,cache=strict,username=guest,domain=LOCALHOST,uid=0,noforceuid,gid=0,noforcegid,addr=172.25.254.108,unix,posixpaths,serverino,acl,rsize=1048576,wsize=65536,actimeo=1)
不显示test共享目录，但是不影响使用
Domain=[WESTOS] OS=[Unix] Server=[Samba 4.1.1]
Sharename Type Comment
--------- ---- -------
mnt Disk mnt test directory
IPC$ IPC IPC Service (Samba Server Version 4.1.1)
以student身份挂载，建立文件
[root@localhost ~]# mount //172.25.254.108/test /mnt -o username=student,password=123
[root@localhost ~]# touch /mnt/fire00
[root@localhost ~]# ll /mnt
total 0
-rw-r--r--. 1 root student 0 May 4 00:31 fire00
4.实现多用户挂载
安装 cifs-utils 软件
配置用户文件 vim /root/samba
查看帮助 man mount.cifs
多用户挂载 mount -o credentials=/root/samba,sec=ntlmssp,multiuer //172.25.254.108/test /mnt
此时root用户
[root@foundation8 ~]# cd /mnt/
[root@foundation8 mnt]# ls
file file123 filetest
[root@foundation8 mnt]# rm -fr file123
rm: cannot remove ‘file123’: Permission denied
[root@foundation8 mnt]# touch test
touch: cannot touch ‘test’: Permission denied
而普通用户
[kiosk@foundation8 yum.repos.d]$ cd /mnt
[kiosk@foundation8 mnt]$ ls
ls: reading directory .: Permission denied
普通用户认证 ##跟/test权限有关
[kiosk@foundation8 mnt]$ cifscreds add -u tom 172.25.254.108
Password:
[kiosk@foundation8 mnt]$ ls
file file123 filetest
[kiosk@foundation8 mnt]$ rm -fr file
rm: cannot remove ‘file’: Permission denied
1.CIFS系统：Internet文件共享系统，也称服务器信；适用于MicrosoftWindows服务器和客户端的标准文件和打印机的共享系统息块（SMB）
2.Samba服务：用于将linux文件系统作为CIFS/SMB网络文件进行共享，并将linux打印机作为CIFS/SMB打印机进行共享
二、Smb服务
1.安装smb服务
[root@localhost ~]# yum install samba samba-common samba-client -y
2.打开smb，列出共享文件系统信息
[root@localhost ~]# systemctl start smb
[root@localhost ~]# smbclient -L //172.25.254.148
3.设置默认域名 [root@localhost ~]# vim /etc/samba/smb.conf
4.设置黑白名单 [root@localhost ~]# vim /etc/samba/smb.conf
（allow白名单 deny黑名单）
5.设置用户登陆 ##注意：必须是本地用户
6.使用用户登陆
[
三、Smb的Selinx保护
当Selinux=Disable时
1.进入用户家目录编辑
（？列出smb可使用的命令）
2.挂载
3.设置开机自动挂载
[root@localhost ~]# vim /etc/fstab
chmod +x /etc/fstab (给个执行权限)
[root@localhost ~]# smbclient //172.25.254.108/tom -U tom
Enter tom's password:
Domain=[WESTOS] OS=[Unix] Server=[Samba 4.1.1]
smb: \> ls
NT_STATUS_ACCESS_DENIED listing \*
2.修改sebool值，进入用户家目录编辑
[root@localhost ~]# setsebool -P samba_enable_home_dirs on
[root@localhost ~]# smbclient //172.25.254.108/tom -U tom
Enter tom's password:
Domain=[WESTOS] OS=[Unix] Server=[Samba 4.1.1]
smb: \> ls
. D 0 Thu May 3 21:49:51 2018
.. D 0 Thu May 3 21:46:34 2018
.bash_profile H 193 Wed Jan 29 07:45:18 2014
.mozilla DH 0 Thu Jul 10 18:29:32 2014
.config DH 0 Thu Jul 10 19:06:52 2014
.bashrc H 231 Wed Jan 29 07:45:18 2014
.bash_logout H 18 Wed Jan 29 07:45:18 2014
60458 blocks of size 8192. 56476 blocks available
3.共享目录
用户建立目录:
修改配置文件，共享tets目录
[root@localhost ~]# mkdir /test
[root@localhost ~]# vim /etc/samba/smb.conf
重启smb，可以看到test目录共享信息
[root@localhost ~]# systemctl restart smb.service
[root@localhost ~]# smbclient -L //172.25.254.108/
Enter root's password:
Anonymous login successful
Domain=[WESTOS] OS=[Unix] Server=[Samba 4.1.1]
Sharename Type Comment
--------- ---- -------
test Disk test directory
IPC$ IPC IPC Service (Samba Server Version 4.1.1)
但是，tom用户登陆无法编辑
[root@localhost ~]# smbclient //172.25.254.108/test -U tom
Enter tom's password:
Domain=[WESTOS] OS=[Unix] Server=[Samba 4.1.1]
smb: \> ls
NT_STATUS_ACCESS_DENIED listing \*
修改test目录的安全上下文，重启后再次登陆编辑
[root@localhost ~]# semanage fcontext -a -t samba_share_t '/test(/.*)?'
[root@localhost ~]# restorecon -RvvF /test/
restorecon reset /test context unconfined_u:object_r:default_t:s0->system_u:object_r:samba_share_t:s0
[root@localhost ~]# systemctl restart smb.service
[root@localhost ~]# smbclient //172.25.254.108/test -U tom
Enter tom's password:
Domain=[WESTOS] OS=[Unix] Server=[Samba 4.1.1]
smb: \> ls
. D 0 Thu May 3 22:48:51 2018
.. D 0 Thu May 3 22:48:51 2018
系统目录：
修改配置文件，共享mnt系统目录
[root@localhost ~]# vim /etc/samba/smb.conf
[mnt]
comment = mnt test directory
path =/mnt
重启后查看共享目录信息
[root@localhost ~]# systemctl restart smb.service
[root@localhost ~]# smbclient -L //172.25.254.108/
Enter root's password:
Anonymous login successful
Domain=[WESTOS] OS=[Unix] Server=[Samba 4.1.1]
Sharename Type Comment
--------- ---- -------
test Disk test directory
mnt Disk mnt test directory
IPC$ IPC IPC Service (Samba Server Version 4.1.1）
设定samba的sebool值，打开所有共享目录的读写权限
[root@localhost ~]# setsebool samba_export_all_rw 1
[root@localhost ~]# smbclient //172.25.254.108/mnt -U tom
Enter tom's password:
Domain=[WESTOS] OS=[Unix] Server=[Samba 4.1.1]
smb: \> ls
. D 0 Thu May 11 20:23:52 2017
.. D 0 Thu May 3 22:48:51 2018
四、多用户挂载
1.指定用户具备读写权限
[root@localhost ~]# vim /etc/samba/smb.conf
[test]
comment = test directory
path =/test
write list =tom ##只有tom用户具备权限
##writable = yes ##所有用户具备权限
##write list =@tom ##只有tom组的用户具备权限
2.设定共享目录的读写权限，重启后测试
[root@localhost ~]# chmod 777 /test/
[root@localhost ~]# systemctl restart smb.service
只有tom用户具备权限
[root@localhost ~]# mount //172.25.254.108/test /mnt -o username=tom,password=123
[root@localhost ~]# touch /mnt/file1
[root@localhost ~]# rm -rf /mnt/file1
挂载jerry用户，不具备权限
[root@localhost ~]# umount /mnt
[root@localhost ~]# mount //172.25.254.108/test /mnt -o username=jerry,password=123
[root@localhost ~]# touch /mnt/file2
touch: cannot touch ‘/mnt/file2’: Permission denied
3.用户相关权限设置
security = user
passdb backend = tdbsam
map to guest = bad user ##匿名用户映射为guest
[test]
comment = test directory
path =/test
writeanle = yes
browseable = no ##不显示test共享目录
guest ok = yes ##允许匿名用户登陆
admin users =student ##studet用户编辑时以root用户身份
匿名用户登陆
[root@localhost ~]# mount //172.25.254.108/test /mnt -o username=guest
[root@localhost ~]# df
//172.25.254.108/test 10473900 3186684 7287216 31% /mnt
//172.25.254.108/test on /mnt type cifs (rw,relatime,vers=1.0,cache=strict,username=guest,domain=LOCALHOST,uid=0,noforceuid,gid=0,noforcegid,addr=172.25.254.108,unix,posixpaths,serverino,acl,rsize=1048576,wsize=65536,actimeo=1)
不显示test共享目录，但是不影响使用
Domain=[WESTOS] OS=[Unix] Server=[Samba 4.1.1]
Sharename Type Comment
--------- ---- -------
mnt Disk mnt test directory
IPC$ IPC IPC Service (Samba Server Version 4.1.1)
以student身份挂载，建立文件
[root@localhost ~]# mount //172.25.254.108/test /mnt -o username=student,password=123
[root@localhost ~]# touch /mnt/fire00
[root@localhost ~]# ll /mnt
total 0
-rw-r--r--. 1 root student 0 May 4 00:31 fire00
4.实现多用户挂载
安装 cifs-utils 软件
配置用户文件 vim /root/samba
查看帮助 man mount.cifs
多用户挂载 mount -o credentials=/root/samba,sec=ntlmssp,multiuer //172.25.254.108/test /mnt
此时root用户
[root@foundation8 ~]# cd /mnt/
[root@foundation8 mnt]# ls
file file123 filetest
[root@foundation8 mnt]# rm -fr file123
rm: cannot remove ‘file123’: Permission denied
[root@foundation8 mnt]# touch test
touch: cannot touch ‘test’: Permission denied
而普通用户
[kiosk@foundation8 yum.repos.d]$ cd /mnt
[kiosk@foundation8 mnt]$ ls
ls: reading directory .: Permission denied
普通用户认证 ##跟/test权限有关
[kiosk@foundation8 mnt]$ cifscreds add -u tom 172.25.254.108
Password:
[kiosk@foundation8 mnt]$ ls
file file123 filetest
[kiosk@foundation8 mnt]$ rm -fr file
rm: cannot remove ‘file’: Permission denied